project-init

SUSPICIOUS: the skill is coherent with its stated bootstrap purpose, but that purpose itself is to install and trust a large bundle of other skills. The main risk is transitive trust and bulk downstream capability expansion, not confirmed malware or direct credential exfiltration.